MALICIOUS — e6b96ddc6029bdc3f1d0e814917a697b7ebdcc4257c4ccaafb8650a36ce57c67

MALICIOUS — e6b96ddc6029bdc3f1d0e814917a697b7ebdcc4257c4ccaafb8650a36ce57c67 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e6b96ddc6029bdc3f1d0e814917a697b7ebdcc4257c4ccaafb8650a36ce57c67
SHA-1: c5a2ea842148311c57b14dc9f8ddb54bd49c755b
MD5: 249d44641443c3025b34e61b4d19fa9e
ssdeep: 1536:v52QacdMsLH4/UtswCroSVV8Rni80Zb2WGpOKv7BPN1W006V+1hp+s:x2QacdM5/p/cRiBtKzJNrVIL
TLSH: T13C38C0F320AFCD4CB68E9F436AF7119CA449E3896172B7904488B66CD5B8BBD7E10540
Submitted as: e6b96ddc6029bdc3f1d0e814917a697b7ebdcc4257c4ccaafb8650a36ce57c67
File type: pdf · Size: 77571 bytes
Verdict: malicious (95/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Contacted 16 external host(s) at runtime (6 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://hotelritariccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/16138f7ce4edae---69878930052.pdf, http://stardentalcare.org/userfiles/file/43545849980.pdf, https://inprovitbrasil.com/ckfinder/userfiles/files/17837604627.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Extracted generic config (19 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9675 behavior events · 0 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 3267c0f065c85eccc4ef05b824d0900497643b281bf000d6e5c87b0bdf36ac7e
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\4cef038264abee35e751f9f475dd217f.png - 2f8582d18d2bf5ddaeb781ee6e7cb82d57134405453adde3ea4f147e81e0a3a7
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=top+gun+maverick+watch+online
https://hotelritariccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/16138f7ce4edae---69878930052.pdf
http://stardentalcare.org/userfiles/file/43545849980.pdf
https://inprovitbrasil.com/ckfinder/userfiles/files/17837604627.pdf
http://jfe.hk/userfiles/wijakewewuzewuvimikokeno.pdf
https://luyenthitoeic.info/userfiles/file/balazajotogewezuzulik.pdf
https://www.sabiamente.es/wp-content/plugins/formcraft/file-upload/server/content/files/16135cc8a9a5c3---midim.pdf
http://udokutscher.de/gfx/userfiles/files/99588493158.pdf
https://pachetedeturism.ro/images/files/33742059881.pdf
https://kaowei.tw/image/files/20210912_230009.pdf
https://thibiditrading.com/public/userupload/files/metizegedulovuxovalokedez.pdf
http://www.mezmat.ru/ckfinder/userfiles/files/85687771185.pdf
http://vinhthuan.vn/upload/files/26606710395.pdf
https://ihotel2b.com/upfiles/editor/files/75610020138.pdf
http://bong-dem-long.org/upload/editor/files/fidonuwujefigafiz.pdf
http://www.lovebliss.tw/UserFiles/files/gifadirevorasojo.pdf
http://runwellconsulting.com/file/file/wuxavekutojepisumofuvuro.pdf
http://werkkledingverkoop.nl/images/docman/files/rarimijebusipipawager.pdf
http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613862df8721c---zitasidi.pdf
http://daugiavanthienphuoc.com/media/ftp/file/jolujelulazo.pdf
https://producto.works/userfiles/file/98298663235.pdf
https://junona.manyel.website/images/uploads/medium/86358680310.pdf
https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/q3ou9e6ol3g4hkovjemjt2ofpr/wubixeturipozi.pdf
http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/16140154b556a6---1278673807.pdf
https://comtraining.cl/userfiles/files/duzizesinidinefitani.pdf

Embedded domains

feedproxy.google.com
hotelritariccione.it
stardentalcare.org
inprovitbrasil.com
jfe.hk
luyenthitoeic.info
www.sabiamente.es
udokutscher.de
kaowei.tw
thibiditrading.com
www.mezmat.ru
ihotel2b.com
bong-dem-long.org
www.lovebliss.tw
runwellconsulting.com
werkkledingverkoop.nl
www.guaitoli.eng.br
daugiavanthienphuoc.com
thepetrichortouch.com
jockmurray.com
bubblesoflove.net
www.w3.org
purl.org
ns.adobe.com
pachetedeturism.ro

Embedded IP addresses

20.247.185.124
48.211.4.16
52.110.12.51
52.110.12.53
4.230.171.124
20.42.72.131
135.232.92.97
20.165.94.63
74.178.76.128
52.123.128.14
72.145.35.99
203.26.79.13
52.123.252.216
135.232.92.34
4.150.223.104
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report